Download Monitor EUVD-2026-91245

Exploitation requires ALL of: (1) a logged-in WordPress Administrator (the only role with the unfiltered_html capability the attack abuses) who is (2) actively on an open Download post edit screen, and (3) is successfully social-engineered into visiting an attacker-controlled page that sends a cross-origin postMessage to that editor; the injected payload only reaches victims once (4) the affected page is rendered on the frontend via the [download_data] shortcode. Limiting factors: the attack is gated on administrator interaction and an open editor context (so it is not truly no-interaction despite UI:N), affects only Download Monitor ≤5.2.10, and depends on the site actually using the [download_data] shortcode for frontend delivery. The unauthenticated framing applies to the attacker's starting position, not to the required admin victim.

This is a genuine but conditional risk rather than a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) and 7.2 HIGH score imply a network-reachable, unauthenticated, no-interaction stored XSS - but that characterization conflicts directly with the description, which states the attack REQUIRES tricking an authenticated Administrator into visiting an attacker-controlled page while a Download edit screen is open. The vector's UI:N is therefore almost certainly wrong: real exploitation is UI-dependent (social-engineering an admin) and the injection only persists because it abuses the Administrator's unfiltered_html capability. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The scope change (S:C) and C:L/I:L are consistent with stored XSS executing in other users' browser contexts. Net: a credible, Wordfence-reported stored XSS in a popular plugin that warrants prompt patching, but the required administrator interaction and specific open-editor precondition make mass, unauthenticated exploitation unrealistic despite the HIGH base score. Verify the UI metric with the vendor/Wordfence before treating this as no-interaction.

An attacker crafts a malicious web page and lures a logged-in WordPress Administrator who has a Download edit screen open into visiting it; the page uses cross-origin postMessage to inject a script payload into the editor, which is saved unfiltered thanks to the admin's unfiltered_html capability. The stored payload is later rendered verbatim by the [download_data] shortcode on the public frontend, executing in the browser of every visitor who views that page. No public exploit code was identified at time of analysis, so weaponization effort would fall on the attacker.